uploadtourl[.]comDomain
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Fake Bank of America Phishing Scam Installs Remote Access Malware“That final script downloads a 17MB Base64-encoded installer from UploadToURL[.]com, decodes it, and writes a ScreenConnect MSI package to the victim's system.”
-
Bank of America Phishing Email Delivers ScreenConnect Malware“First, it downloads a base64-encoded file from the otherwise legitimate public file-sharing website, UploadToURL[.]com, then decodes the content.”
Indicators reported together
named in the same reports- 217.60.195[.]167in 2 reports
- bkofamerica[.]comin 2 reports
- kleinschnitg[.]comin 2 reports
- sectioncompil[.]comin 2 reports
- ealerts.bkofamerica[.]comin 1 report
- 3e404e542ae99eeb…7efb0a2dbfb8in 1 report
- f580d528759829f6…e483b239e8a4in 1 report
- 6d1dae4794a80caa…94bf2b2a3f10in 1 report
- ed9f4c15d2857260…8c296a3c66f2in 1 report
- d0913e83d10cadae…9b9c41c0f4bfin 1 report
- bd987f9f493a234a…064e09cdc0eein 1 report
- hxxps://kleinschnitg[.]com/F3bebOag/?id=emailin 1 report
- hxxps://sectioncompil[.]com/wkudpl/windows/manage.htmlin 1 report
- hxxps://sectioncompil[.]com/wkudpl/windows/download/AccountGuardSetup.zipin 1 report
- hxxps://sectioncompil[.]com/wkudpl/notarize.phpin 1 report
- hxxps://sectioncompil[.]com/wkudpl/main.phpin 1 report
- hxxps://cdn.uploadtourl[.]com/3b154d8e-61be-4521-b3c3-75efb845a2e2_msi_base64.txtin 1 report
- cdn.uploadtourl[.]comin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.